#19941 [NEW]: ImageTrueColorToPalette crashes with bundled libgd with last parameter set to 0

From: mfischer@php.net Operating system: Linux PHP version: 4CVS-2002-10-16 PHP Bug Type: GD related Bug description: ImageTrueColorToPalette crashes with bundled libgd with last parameter set to 0 Calling ImageTrueColorToPalette() with the last parameter set to 0 causes a segfault: Program received signal SIGSEGV, Segmentation fault. 0x4013b84b in free () from /lib/libc.so.6 (gdb) bt #0 0x4013b84b in free () from /lib/libc.so.6 #1 0x4013b6d3 in free () from /lib/libc.so.6 #2 0x080824da in gdFree (ptr=0x82897c0) at /home/mfischer/isrc/cvs/php4/ext/gd/libgd/gdhelpers.c:95 #3 0x08083515 in select_colors (im=0x8290b18, cquantize=0x82930c0, desired_colors=0) at /home/mfischer/isrc/cvs/php4/ext/gd/libgd/gd_topal.c:701 #4 0x08084804 in gdImageTrueColorToPalette (im=0x8290b18, dither=0, colorsWanted=0) at /home/mfischer/isrc/cvs/php4/ext/gd/libgd/gd_topal.c:1562 #5 0x0806b073 in zif_imagetruecolortopalette (ht=3, return_value=0x829321c, this_ptr=0x0, return_value_used=0) at /home/mfischer/isrc/cvs/php4/ext/gd/gd.c:648 #6 0x081af8e3 in execute (op_array=0x828ea14) at /home/mfischer/isrc/cvs/php4/Zend/zend_execute.c:1597 #7 0x0819ee49 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/mfischer/isrc/cvs/php4/Zend/zend.c:839 #8 0x0816d681 in php_execute_script (primary_file=0xbffffa40) at /home/mfischer/isrc/cvs/php4/main/main.c:1542 #9 0x081b5420 in main (argc=2, argv=0xbffffac4) at /home/mfischer/isrc/cvs/php4/sapi/cli/php_cli.c:695 -- Edit bug report at http://bugs.php.net/?id=19941&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=19941&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=19941&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=19941&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=19941&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=19941&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=19941&r=support Expected behavior: http://bugs.php.net/fix.php?id=19941&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=19941&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=19941&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=19941&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=19941&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=19941&r=dst IIS Stability: http://bugs.php.net/fix.php?id=19941&r=isapi